Hello,

I'm currently working on a plugin for x32dbg and I was wondering if there is another way to disassemble a function where I can receive information like the opcode as char so I don't have to work with the char array to see what kind of instruction I'm dealing with. And I also want to know if there is a way to see if the argument from the DISASM_INSTR array is a register, pointer, memory value/constant or such also without dealing with the char array.

Regards,

Castor

DbgDisasmFastAt uses a BASIC_INSTRUCTION_INFO structure:

BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo); 

and you can then access the returned BASIC_INSTRUCTION_INFO structure to read information such as type, branch etc:

typedef struct
{
    duint value; //displacement / addrvalue (rip-relative)
    MEMORY_SIZE size; //byte/word/dword/qword
    char mnemonic[MAX_MNEMONIC_SIZE];
} MEMORY_INFO;

typedef struct
{
    duint value;
    VALUE_SIZE size;
} VALUE_INFO;

//definitions for BASIC_INSTRUCTION_INFO.type
#define TYPE_VALUE 1
#define TYPE_MEMORY 2
#define TYPE_ADDR 4

typedef struct
{
    DWORD type; //value|memory|addr
    VALUE_INFO value; //immediat
    MEMORY_INFO memory;
    duint addr; //addrvalue (jumps + calls)
    bool branch; //jumps/calls
    bool call; //instruction is a call
    int size;
    char instruction[MAX_MNEMONIC_SIZE * 4];
} BASIC_INSTRUCTION_INFO;

The xAnalyzer plugin makes use of this: https://github.com/ThunderCls/xAnalyzer/blob/master/xAnalyzer/xanalyzer.cpp#L329

Hope that helps.

 

 

Thanks for your response!

But I was looking for a more "abstract" way instead of dealing with strings. But I wrote a small parser which handles the diassembled instruction which works fine for now.

You don't really have to deal with strings.

Use DISASM_ARG.type to see if it's memory or a number/register. Then you can use DISASM_ARG.const to get the imm value or DISASM_ARG.value to get the register value. If isdigit(DISASM_ARG.mnemonic) is true you know that it's a constant. However probably you are looking for capstone, it has exact details on the instruction data. This function is only used by the GUI to provide context-sensitive operations.

I think my main problem was/is to handle instructions like this:

mov eax,dword ptr ds:[ebx]		; 1)
mov eax,dword ptr ds:[486486]		; 2)
mov eax,dword ptr ds:[ecx+EA]		; 3)
mov eax,dword ptr ds:[ebx+ecx*4]	; 4)
mov eax,dword ptr ds:[ecx*4+486486]	; 5)
mov eax,dword ptr ds:[ebx+ecx]		; 6)

1) and 2) are easy to solve, but I was struggeling with the rest because my goal was to cut that argument down into pieces so I can change for example in 5) the scale *4, in 4) ecx into another register or in 3) the EA into another value. My ugly solution is to use regular expressions.

In that case you need to use capstone.

Thank you I'm using your Capstone wrapper now and it works!

Edited May 22, 20178 yr by Castor